From 108f93cf5855dd3d8ad3878650405159b4ce63eb Mon Sep 17 00:00:00 2001 From: Beck Davis Date: Fri, 15 Nov 2024 13:52:13 -0500 Subject: [PATCH 1/8] Create logs role Co-authored-by: Francis Kayiwa Co-authored-by: Vickie Karasic --- logs/.ansible-lint | 14 +++++++++ logs/.yamllint | 14 +++++++++ logs/meta/main.yml | 17 +++++++++++ logs/molecule/default/converge.yml | 15 ++++++++++ logs/molecule/default/molecule.yml | 22 ++++++++++++++ logs/molecule/default/verify.yml | 20 +++++++++++++ roles/logs/README.md | 38 ++++++++++++++++++++++++ roles/logs/defaults/main.yml | 2 ++ roles/logs/handlers/main.yml | 2 ++ roles/logs/meta/main.yml | 17 +++++++++++ roles/logs/molecule/default/converge.yml | 15 ++++++++++ roles/logs/molecule/default/molecule.yml | 22 ++++++++++++++ roles/logs/molecule/default/verify.yml | 20 +++++++++++++ roles/logs/tasks/main.yml | 28 +++++++++++++++++ roles/logs/vars/main.yml | 2 ++ 15 files changed, 248 insertions(+) create mode 100644 logs/.ansible-lint create mode 100644 logs/.yamllint create mode 100644 logs/meta/main.yml create mode 100644 logs/molecule/default/converge.yml create mode 100644 logs/molecule/default/molecule.yml create mode 100644 logs/molecule/default/verify.yml create mode 100644 roles/logs/README.md create mode 100644 roles/logs/defaults/main.yml create mode 100644 roles/logs/handlers/main.yml create mode 100644 roles/logs/meta/main.yml create mode 100644 roles/logs/molecule/default/converge.yml create mode 100644 roles/logs/molecule/default/molecule.yml create mode 100644 roles/logs/molecule/default/verify.yml create mode 100644 roles/logs/tasks/main.yml create mode 100644 roles/logs/vars/main.yml diff --git a/logs/.ansible-lint b/logs/.ansible-lint new file mode 100644 index 0000000000..2fa23367de --- /dev/null +++ b/logs/.ansible-lint @@ -0,0 +1,14 @@ +--- +skip_list: + - ANSIBLE0002 + - ANSIBLE0006 + - ANSIBLE0010 + - ANSIBLE0016 + - '303' + - '305' + - '306' + - '403' + - '503' + - '204' +use_default_rules: true +verbosity: 1 diff --git a/logs/.yamllint b/logs/.yamllint new file mode 100644 index 0000000000..8bb60ab5e3 --- /dev/null +++ b/logs/.yamllint @@ -0,0 +1,14 @@ +--- +extends: default + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + line-length: disable + # NOTE(retr0h): Templates no longer fail this lint rule. + # Uncomment if running old Molecule templates. + # truthy: disable diff --git a/logs/meta/main.yml b/logs/meta/main.yml new file mode 100644 index 0000000000..82248f8112 --- /dev/null +++ b/logs/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: + company: Princeton University Library + description: + author: pulibrary + + license: MIT + + min_ansible_version: 2.2 + + platforms: + - name: Ubuntu + versions: + - jammy +dependencies: + - role: "" diff --git a/logs/molecule/default/converge.yml b/logs/molecule/default/converge.yml new file mode 100644 index 0000000000..470bb54fdf --- /dev/null +++ b/logs/molecule/default/converge.yml @@ -0,0 +1,15 @@ +--- +- name: Converge + hosts: all + vars: + - running_on_server: false + become: true + pre_tasks: + - name: Update cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 600 + tasks: + - name: "Include example" + ansible.builtin.include_role: + name: example diff --git a/logs/molecule/default/molecule.yml b/logs/molecule/default/molecule.yml new file mode 100644 index 0000000000..fc1de4aea1 --- /dev/null +++ b/logs/molecule/default/molecule.yml @@ -0,0 +1,22 @@ +--- +scenario: + name: default +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint +platforms: + - name: instance + image: "ghcr.io/pulibrary/pul_containers:jammy_multi" + command: "sleep infinity" + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + privileged: true + pre_build_image: true +provisioner: + name: ansible + log: true +verifier: + name: ansible diff --git a/logs/molecule/default/verify.yml b/logs/molecule/default/verify.yml new file mode 100644 index 0000000000..6972c17318 --- /dev/null +++ b/logs/molecule/default/verify.yml @@ -0,0 +1,20 @@ +--- +- name: Verify + hosts: all + gather_facts: false + tasks: + - name: Check ruby package status + ansible.builtin.package: + name: "{{ item }}" + state: present + check_mode: true + register: pkg_status + loop: + - ruby-switch + - ruby2.6-dev + - ruby2.6 + + - name: Test for ruby packages + ansible.builtin.assert: + that: + - not pkg_status.changed diff --git a/roles/logs/README.md b/roles/logs/README.md new file mode 100644 index 0000000000..225dd44b9f --- /dev/null +++ b/roles/logs/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/logs/defaults/main.yml b/roles/logs/defaults/main.yml new file mode 100644 index 0000000000..c948644abf --- /dev/null +++ b/roles/logs/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for roles/logs diff --git a/roles/logs/handlers/main.yml b/roles/logs/handlers/main.yml new file mode 100644 index 0000000000..93e5bf8a1a --- /dev/null +++ b/roles/logs/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for roles/logs diff --git a/roles/logs/meta/main.yml b/roles/logs/meta/main.yml new file mode 100644 index 0000000000..d18dbc1e2c --- /dev/null +++ b/roles/logs/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: logs + company: Princeton University Library + description: logs + author: pulibrary + + license: MIT + + min_ansible_version: 2.9 + + platforms: + - name: Ubuntu + versions: + - jammy +dependencies: + - role: "common" diff --git a/roles/logs/molecule/default/converge.yml b/roles/logs/molecule/default/converge.yml new file mode 100644 index 0000000000..c3d824bfee --- /dev/null +++ b/roles/logs/molecule/default/converge.yml @@ -0,0 +1,15 @@ +--- +- name: Converge + hosts: all + vars: + - running_on_server: false + become: true + pre_tasks: + - name: Update cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 600 + tasks: + - name: "Include logs" + ansible.builtin.include_role: + name: logs diff --git a/roles/logs/molecule/default/molecule.yml b/roles/logs/molecule/default/molecule.yml new file mode 100644 index 0000000000..fc1de4aea1 --- /dev/null +++ b/roles/logs/molecule/default/molecule.yml @@ -0,0 +1,22 @@ +--- +scenario: + name: default +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint +platforms: + - name: instance + image: "ghcr.io/pulibrary/pul_containers:jammy_multi" + command: "sleep infinity" + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + privileged: true + pre_build_image: true +provisioner: + name: ansible + log: true +verifier: + name: ansible diff --git a/roles/logs/molecule/default/verify.yml b/roles/logs/molecule/default/verify.yml new file mode 100644 index 0000000000..6972c17318 --- /dev/null +++ b/roles/logs/molecule/default/verify.yml @@ -0,0 +1,20 @@ +--- +- name: Verify + hosts: all + gather_facts: false + tasks: + - name: Check ruby package status + ansible.builtin.package: + name: "{{ item }}" + state: present + check_mode: true + register: pkg_status + loop: + - ruby-switch + - ruby2.6-dev + - ruby2.6 + + - name: Test for ruby packages + ansible.builtin.assert: + that: + - not pkg_status.changed diff --git a/roles/logs/tasks/main.yml b/roles/logs/tasks/main.yml new file mode 100644 index 0000000000..78fd75192b --- /dev/null +++ b/roles/logs/tasks/main.yml @@ -0,0 +1,28 @@ +--- +# tasks file for roles/logs +- name: logs | ensure grafana key ring exists + ansible.builtin.file: + path: /etc/apt/keyrings/ + state: directory + mode: '0755' + +- name: logs | add grafana key and repo + block: + - name: grafanarepo |no apt key + ansible.builtin.get_url: + url: https://apt.grafana.com/gpg.key + dest: /etc/apt/keyrings/grafana.gpg + + - name: grafanarepo | apt source + ansible.builtin.apt_repository: + repo: "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main {{ ansible_distribution_release }} stable" + state: present + file: grafana + +- name: logs | install grafana and promtail + ansible.builtin.apt: + name: "{{ item }}" + update_cache: true + loop: + - loki + - promtail \ No newline at end of file diff --git a/roles/logs/vars/main.yml b/roles/logs/vars/main.yml new file mode 100644 index 0000000000..cba806bf9f --- /dev/null +++ b/roles/logs/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for roles/logs From 9a1882ab8bb0c622da79c2d07f2e00b627a4b9ae Mon Sep 17 00:00:00 2001 From: Beck Davis Date: Fri, 15 Nov 2024 13:53:34 -0500 Subject: [PATCH 2/8] add grafana to tasks/main.yml --- roles/logs/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/logs/tasks/main.yml b/roles/logs/tasks/main.yml index 78fd75192b..f73d3f06ce 100644 --- a/roles/logs/tasks/main.yml +++ b/roles/logs/tasks/main.yml @@ -24,5 +24,6 @@ name: "{{ item }}" update_cache: true loop: + - grafana - loki - promtail \ No newline at end of file From d8f9b600cc4050acbf5170a2cf61d27636e64150 Mon Sep 17 00:00:00 2001 From: Francis Kayiwa Date: Wed, 20 Nov 2024 10:53:25 -0500 Subject: [PATCH 3/8] configure the apt repo and keys the shell command is needed to ensure that the downloaded key from grafana gets dearmored. added linting on the tasks we have a successful install of promtail, loki and grafana Co-authored-by: Beck Davis Co-authored-by: Vickie Karasic --- roles/logs/tasks/main.yml | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/roles/logs/tasks/main.yml b/roles/logs/tasks/main.yml index f73d3f06ce..12521949be 100644 --- a/roles/logs/tasks/main.yml +++ b/roles/logs/tasks/main.yml @@ -1,29 +1,26 @@ --- # tasks file for roles/logs -- name: logs | ensure grafana key ring exists +- name: Logs | ensure grafana key ring exists ansible.builtin.file: path: /etc/apt/keyrings/ state: directory mode: '0755' -- name: logs | add grafana key and repo - block: - - name: grafanarepo |no apt key - ansible.builtin.get_url: - url: https://apt.grafana.com/gpg.key - dest: /etc/apt/keyrings/grafana.gpg +- name: Logs | add grafana key and repo + ansible.builtin.shell: /usr/bin/wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg + changed_when: false - - name: grafanarepo | apt source - ansible.builtin.apt_repository: - repo: "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main {{ ansible_distribution_release }} stable" - state: present - file: grafana +- name: Grafanarepo | apt source + ansible.builtin.apt_repository: + repo: "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" + state: present + filename: grafana -- name: logs | install grafana and promtail +- name: Logs | install grafana and promtail ansible.builtin.apt: name: "{{ item }}" update_cache: true - loop: + loop: - grafana - loki - - promtail \ No newline at end of file + - promtail From 5a47f3581421f3f8ed86853bf858fb3abd39d4dc Mon Sep 17 00:00:00 2001 From: Francis Kayiwa Date: Fri, 22 Nov 2024 11:59:13 -0500 Subject: [PATCH 4/8] initial temp config --- roles/logs/templates/config.yaml.j2 | 36 +++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 roles/logs/templates/config.yaml.j2 diff --git a/roles/logs/templates/config.yaml.j2 b/roles/logs/templates/config.yaml.j2 new file mode 100644 index 0000000000..78c585a897 --- /dev/null +++ b/roles/logs/templates/config.yaml.j2 @@ -0,0 +1,36 @@ + +# This is a complete configuration to deploy Loki backed by a GCS. +# Index files will be written locally at /loki/index and, eventually, will be shipped to the storage via tsdb-shipper. +# {{ ansible_managed | comment }} + +auth_enabled: false + +server: + http_listen_port: 3100 + log_level: info + grpc_listen_port: 9095 + +common: + ring: + instance_addr: 127.0.0.1 + kvstore: + store: inmemory + replication_factor: 1 + path_prefix: /var/lib/loki + +schema_config: + configs: + - from: 2020-05-15 + store: tsdb + object_store: gcs + schema: v13 + index: + prefix: index_ + period: 24h + +storage_config: + tsdb_shipper: + active_index_directory: /var/lib/loki/index + cache_location: /var/lib/loki/index_cache + gcs: + bucket_name: replace_by_your_bucked_name From 2d2d55eb1dc6a76b07ef8337c9577181281ae323 Mon Sep 17 00:00:00 2001 From: Francis Kayiwa Date: Fri, 13 Dec 2024 14:45:21 -0500 Subject: [PATCH 5/8] first pass at a template ldap config we add a template config for loki. we have added a task to stip the grafana config to fit a smaller template uncovered that loki need gcs setup on vms Co-authored-by: Beck Davis Co-authored-by: Vickie Karasic --- roles/logs/defaults/main.yml | 3 ++ roles/logs/tasks/main.yml | 11 ++++- roles/logs/templates/ldap.toml.j2 | 81 +++++++++++++++++++++++++++++++ 3 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 roles/logs/templates/ldap.toml.j2 diff --git a/roles/logs/defaults/main.yml b/roles/logs/defaults/main.yml index c948644abf..04e5c164cd 100644 --- a/roles/logs/defaults/main.yml +++ b/roles/logs/defaults/main.yml @@ -1,2 +1,5 @@ --- # defaults file for roles/logs +logs_ldap_host: "{{ omit }}" +logs_bind_dn: "{{ omit }}" +logs_bind_password: "{{ omit }}" diff --git a/roles/logs/tasks/main.yml b/roles/logs/tasks/main.yml index 12521949be..eec4796d72 100644 --- a/roles/logs/tasks/main.yml +++ b/roles/logs/tasks/main.yml @@ -10,7 +10,7 @@ ansible.builtin.shell: /usr/bin/wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg changed_when: false -- name: Grafanarepo | apt source +- name: Logs | Grafanarepo apt source ansible.builtin.apt_repository: repo: "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" state: present @@ -24,3 +24,12 @@ - grafana - loki - promtail + +- name: Logs | Replace domain entry with our inventory name + ansible.builtin.lineinfile: + path: /etc/grafana/grafana.ini + regexp: '' + line: domain="{{ inventory_hostname }}" + owner: root + group: root + mode: '0644' diff --git a/roles/logs/templates/ldap.toml.j2 b/roles/logs/templates/ldap.toml.j2 new file mode 100644 index 0000000000..ee724027bb --- /dev/null +++ b/roles/logs/templates/ldap.toml.j2 @@ -0,0 +1,81 @@ +# {{ ansible_managed | comment }} +# +# To troubleshoot and get more log info enable ldap debug logging in grafana.ini +# [log] +# filters = ldap:debug + +[[servers]] +# Ldap server host (specify multiple hosts space separated) +host = "{{ logs_ldap_host }}" +# Default port is 389 or 636 if use_ssl = true +port = 636 +# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS) +use_ssl = true +# If set to true, use LDAP with STARTTLS instead of LDAPS +start_tls = false +# The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"]) +# For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go +# Starting with Grafana v11.0 only ciphers with ECDHE support are accepted for TLS 1.2 connections. +tls_ciphers = [] +# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1 (only for Grafana v10.4 or older), TLS1.2, TLS1.3. +min_tls_version = "" +# set to true if you want to skip ssl cert validation +ssl_skip_verify = false +# set to the path to your root CA certificate or leave unset to use system defaults +# root_ca_cert = "/path/to/certificate.crt" +# Authentication against LDAP servers requiring client certificates +# client_cert = "/path/to/client.crt" +# client_key = "/path/to/client.key" + +# Search user bind dn +bind_dn = "{{ logs_bind_dn }}" +# Search user bind password +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +bind_password = "{{ logs_bind_password }}" +# We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion +# bind_password = '$__env{LDAP_BIND_PASSWORD}' + +# Timeout in seconds (applies to each host specified in the 'host' entry (space separated)) +timeout = 10 + +# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)" +search_filter = "(sAMAccountName=%s)" +# search_filter = "(&(objectCategory=Person)(sAMAccountName=*))" + +# An array of base dns to search through +search_base_dns = ["dc=pu,dc=win,dc=princeton,dc=edu"] + +## For Posix or LDAP setups that does not support member_of attribute you can define the below settings +## Please check grafana LDAP docs for examples +# group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))" +group_search_filter = "(objectclass=group)" +# group_search_base_dns = ["ou=groups,dc=grafana,dc=org"] +group_search_base_dns = ["ou=grouper,dc=pu,dc=win,dc=princeton,dc=edu"] +# group_search_filter_user_attribute = "uid" + +# Specify names of the ldap attributes your ldap uses +[servers.attributes] +name = "givenName" +surname = "sn" +username = "cn" +member_of = "memberOf" +email = "email" + +# Map ldap groups to grafana org roles +[[servers.group_mappings]] +# group_dn = "cn=admins,ou=grouper,dc=pu,dc=win,dc=princeton,dc=edu" +group_dn = "cn=pu:lib:devops:users,ou=grouper,dc=pu,dc=win,dc=princeton,dc=edu" +org_role = "Admin" +# To make user an instance admin (Grafana Admin) uncomment line below +grafana_admin = true +# The Grafana organization database id, optional, if left out the default org (id 1) will be used +# org_id = 1 + +[[servers.group_mappings]] +group_dn = "cn=editors,ou=groups,dc=grafana,dc=org" +org_role = "Editor" + +[[servers.group_mappings]] +# If you want to match all (or no ldap groups) then you can use wildcard +group_dn = "*" +org_role = "Viewer" From ad2e7854bde528986a50de5f4f1cabb63fdb5649 Mon Sep 17 00:00:00 2001 From: Francis Kayiwa Date: Mon, 16 Dec 2024 07:57:31 -0500 Subject: [PATCH 6/8] use templates add configuration templates for loki, grafana and grafana auth --- roles/logs/defaults/main.yml | 2 + roles/logs/handlers/main.yml | 9 + roles/logs/molecule/default/molecule.yml | 14 +- roles/logs/tasks/main.yml | 29 +- .../{config.yaml.j2 => config.yml.j2} | 2 +- roles/logs/templates/grafana.ini.j2 | 1053 +++++++++++++++++ 6 files changed, 1100 insertions(+), 9 deletions(-) rename roles/logs/templates/{config.yaml.j2 => config.yml.j2} (94%) create mode 100644 roles/logs/templates/grafana.ini.j2 diff --git a/roles/logs/defaults/main.yml b/roles/logs/defaults/main.yml index 04e5c164cd..0ffc79839e 100644 --- a/roles/logs/defaults/main.yml +++ b/roles/logs/defaults/main.yml @@ -3,3 +3,5 @@ logs_ldap_host: "{{ omit }}" logs_bind_dn: "{{ omit }}" logs_bind_password: "{{ omit }}" +logs_loadbalancer_dns_name: "kennyloggin-example.edu" +logs_bucket_name: "kennyloggin-gcs-bucket" diff --git a/roles/logs/handlers/main.yml b/roles/logs/handlers/main.yml index 93e5bf8a1a..79b7b91e94 100644 --- a/roles/logs/handlers/main.yml +++ b/roles/logs/handlers/main.yml @@ -1,2 +1,11 @@ --- # handlers file for roles/logs +- name: Restart grafana + ansible.builtin.systemd: + name: grafana-server + state: restarted + +- name: Restart loki + ansible.builtin.service: + name: loki + state: restarted diff --git a/roles/logs/molecule/default/molecule.yml b/roles/logs/molecule/default/molecule.yml index fc1de4aea1..ec0fc58c6b 100644 --- a/roles/logs/molecule/default/molecule.yml +++ b/roles/logs/molecule/default/molecule.yml @@ -10,13 +10,23 @@ lint: | platforms: - name: instance image: "ghcr.io/pulibrary/pul_containers:jammy_multi" - command: "sleep infinity" + command: "/lib/systemd/systemd" volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro + - /sys/fs/cgroup:/sys/fs/cgroup:rw + tmpfs: + - /tmp + - /run + - /run/lock + - /tmp/ansible + cgroupns_mode: host privileged: true pre_build_image: true provisioner: name: ansible + config_options: + defaults: + remote_tmp: /tmp/ansible log: true verifier: name: ansible + diff --git a/roles/logs/tasks/main.yml b/roles/logs/tasks/main.yml index eec4796d72..5f19b6fc64 100644 --- a/roles/logs/tasks/main.yml +++ b/roles/logs/tasks/main.yml @@ -25,11 +25,28 @@ - loki - promtail -- name: Logs | Replace domain entry with our inventory name - ansible.builtin.lineinfile: - path: /etc/grafana/grafana.ini - regexp: '' - line: domain="{{ inventory_hostname }}" +- name: Logs | add loki config + ansible.builtin.template: + src: config.yml.j2 + dest: /etc/loki/config.yml owner: root group: root - mode: '0644' + mode: '0640' + notify: Restart loki + +- name: Logs | add grafana ldap config + ansible.builtin.template: + src: ldap.toml.j2 + dest: /etc/grafana/ldap.toml + owner: root + group: root + mode: '0640' + +- name: Logs | add grafana config + ansible.builtin.template: + src: grafana.ini.j2 + dest: /etc/grafana/grafana.ini + owner: root + group: root + mode: '0640' + notify: Restart grafana diff --git a/roles/logs/templates/config.yaml.j2 b/roles/logs/templates/config.yml.j2 similarity index 94% rename from roles/logs/templates/config.yaml.j2 rename to roles/logs/templates/config.yml.j2 index 78c585a897..6edd139a31 100644 --- a/roles/logs/templates/config.yaml.j2 +++ b/roles/logs/templates/config.yml.j2 @@ -33,4 +33,4 @@ storage_config: active_index_directory: /var/lib/loki/index cache_location: /var/lib/loki/index_cache gcs: - bucket_name: replace_by_your_bucked_name + bucket_name: "{{ logs_bucket_name }}" diff --git a/roles/logs/templates/grafana.ini.j2 b/roles/logs/templates/grafana.ini.j2 new file mode 100644 index 0000000000..fbf7e03603 --- /dev/null +++ b/roles/logs/templates/grafana.ini.j2 @@ -0,0 +1,1053 @@ +# {{ ansible_managed | comment }} +# +# Everything has defaults so you only need to uncomment things you want to +# change + +#################################### Paths #################################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +;data = /var/lib/grafana + +# Temporary files in `data` directory older than given duration will be removed +;temp_data_lifetime = 24h + +# Directory where grafana can store logs +;logs = /var/log/grafana + + +#################################### Server #################################### +[server] + +# The public facing domain name used to access grafana from a browser +domain = "{{ logs_loadbalancer_dns_name }}" + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +;enforce_domain = false + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +#################################### GRPC Server ######################### +;[grpc_server] +;network = "tcp" +;address = "127.0.0.1:10000" +;use_tls = false +;cert_file = +;key_file = +;max_recv_msg_size = +;max_send_msg_size = +# this will log the request and response for each unary gRPC call +;enable_logging = false + +#################################### Database #################################### +[database] + +# Either "mysql", "postgres" or "sqlite3", it's your choice +;type = sqlite3 +;host = 127.0.0.1:3306 +;name = grafana +;user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +;password = +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +;url = + +# For "postgres", use either "disable", "require" or "verify-full" +# For "mysql", use either "true", "false", or "skip-verify". +;ssl_mode = disable + +# For "postgres", use either "1" to enable or "0" to disable SNI +;ssl_sni = + +# For "mysql" and "postgres" only. Lock the database for the migrations, default is true. +;migration_locking = true + +# For "mysql" and "postgres" only. How many seconds to wait before failing to lock the database for the migrations, default is 0. +;locking_attempt_timeout_sec = 0 + +# Set to true to add metrics and tracing for database queries. +;instrument_queries = false + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +;type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +;connstr = + +# prefix prepended to all the keys in the remote cache +; prefix = + +# This enables encryption of values stored in the remote cache +;encryption = + +#################################### Security #################################### +[security] +# disable creation of admin user on first start of grafana +;disable_initial_admin_creation = false + +# default admin user, created on startup +;admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +;admin_password = admin + +# default admin email, created on startup +;admin_email = admin@localhost + +# used for signing +;secret_key = SW2YcwTIb9zpOOhoPsMm + +# current key provider used for envelope encryption, default to static value specified by secret_key +;encryption_provider = secretKey.v1 + +# list of configured key providers, space separated (Enterprise only): e.g., awskms.v1 azurekv.v1 +;available_encryption_providers = + +# disable gravatar profile images +;disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +;data_source_proxy_whitelist = + +# disable protection against brute force login attempts +;disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +;cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +;cookie_samesite = lax + +# set to true if you want to allow browsers to render Grafana in a ,